Medium
SvelteKit allows XSS via tracked search_params
Type: advisorySources: OSV
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL. This vulnerability is fixed in 2.20.6.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-32388
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:48 UTC · Revision 1
Source evidence
SvelteKit allows XSS via tracked search_params
core-osv · Original sourcePublished 15 Apr 2025, 22:32 UTC
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL. This vulnerability is fixed in 2.20.6.
osv:CVE-2025-32388
Complete source record
{
"id": "aca47d5e1bed6fc371684fcbbb4dfeb030dc9ce337fe4ae586bf1f0e7c603e33",
"url": "https://osv.dev/vulnerability/CVE-2025-32388",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "SvelteKit allows XSS via tracked search_params",
"summary": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL. This vulnerability is fixed in 2.20.6.",
"evidence": "osv:CVE-2025-32388",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-32388",
"aliases": [
"CVE-2025-32388",
"GHSA-6q87-84jw-cjhp"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/sveltejs/kit",
"type": "GIT",
"events": [
{
"introduced": "2ab20205163f303de3c850c2b618259440aabddd"
},
{
"fixed": "711d37a788d6c5f522caf8c348d1a587f90b30fa"
},
{
"fixed": "d3300c6a67908590266c363dba7b0835d9a194cf"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.20.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "d3300c6a67908590266c363dba7b0835d9a194cf"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"@sveltejs/package@2.3.11",
"@sveltejs/kit@2.20.5",
"@sveltejs/kit@2.20.4",
"@sveltejs/adapter-vercel@5.7.0",
"@sveltejs/adapter-cloudflare@7.0.1",
"@sveltejs/adapter-auto@6.0.0",
"@sveltejs/kit@2.20.3",
"@sveltejs/adapter-cloudflare@7.0.0",
"@sveltejs/adapter-cloudflare@6.0.1",
"@sveltejs/kit@2.20.2",
"@sveltejs/adapter-netlify@5.0.0",
"@sveltejs/adapter-cloudflare@6.0.0",
"@sveltejs/adapter-auto@5.0.0",
"@sveltejs/kit@2.20.1",
"@sveltejs/kit@2.20.0",
"@sveltejs/kit@2.19.2",
"@sveltejs/adapter-cloudflare@5.1.0",
"@sveltejs/adapter-cloudflare-workers@2.9.0",
"@sveltejs/kit@2.19.1",
"@sveltejs/kit@2.19.0",
"@sveltejs/kit@2.18.0",
"@sveltejs/kit@2.17.3",
"@sveltejs/adapter-netlify@4.4.2",
"@sveltejs/adapter-cloudflare-workers@2.8.0",
"@sveltejs/adapter-vercel@5.6.3",
"@sveltejs/kit@2.17.2",
"@sveltejs/adapter-vercel@5.6.2",
"@sveltejs/adapter-cloudflare@5.0.3",
"@sveltejs/kit@2.17.1",
"@sveltejs/adapter-vercel@5.6.1",
"@sveltejs/package@2.3.10",
"@sveltejs/kit@2.17.0",
"@sveltejs/adapter-vercel@5.6.0",
"@sveltejs/adapter-cloudflare@5.0.2",
"@sveltejs/adapter-cloudflare-workers@2.7.1",
"@sveltejs/package@2.3.9",
"@sveltejs/adapter-netlify@4.4.1",
"@sveltejs/package@2.3.8",
"@sveltejs/kit@2.16.1",
"@sveltejs/kit@2.16.0",
"@sveltejs/adapter-vercel@5.5.3",
"@sveltejs/adapter-node@5.2.12",
"@sveltejs/kit@2.15.3",
"@sveltejs/adapter-cloudflare@5.0.1",
"@sveltejs/adapter-auto@4.0.0",
"@sveltejs/kit@2.15.2",
"@sveltejs/kit@2.15.1",
"@sveltejs/adapter-cloudflare@5.0.0",
"@sveltejs/kit@2.15.0",
"@sveltejs/kit@2.14.1",
"@sveltejs/adapter-static@3.0.8",
"@sveltejs/adapter-static@3.0.7",
"@sveltejs/kit@2.14.0",
"@sveltejs/kit@2.13.0",
"@sveltejs/adapter-cloudflare@4.9.0",
"@sveltejs/kit@2.12.2",
"@sveltejs/adapter-node@5.2.11",
"@sveltejs/kit@2.12.1",
"@sveltejs/kit@2.12.0",
"@sveltejs/kit@2.11.1",
"@sveltejs/enhanced-img@0.4.4",
"@sveltejs/kit@2.11.0",
"@sveltejs/adapter-node@5.2.10",
"@sveltejs/adapter-cloudflare-workers@2.7.0",
"@sveltejs/kit@2.10.1",
"@sveltejs/kit@2.10.0",
"@sveltejs/adapter-vercel@5.5.2",
"@sveltejs/enhanced-img@0.4.3",
"@sveltejs/kit@2.9.1",
"@sveltejs/enhanced-img@0.4.2",
"@sveltejs/adapter-vercel@5.5.1",
"@sveltejs/kit@2.9.0",
"@sveltejs/adapter-vercel@5.5.0",
"@sveltejs/adapter-netlify@4.4.0",
"@sveltejs/adapter-cloudflare@4.8.0",
"@sveltejs/adapter-cloudflare-workers@2.6.0",
"@sveltejs/kit@2.8.4",
"@sveltejs/kit@2.8.5",
"@sveltejs/kit@2.8.3",
"@sveltejs/kit@2.8.2",
"@sveltejs/adapter-vercel@5.4.8",
"@sveltejs/kit@2.8.1",
"@sveltejs/kit@2.8.0",
"@sveltejs/adapter-vercel@5.4.7",
"@sveltejs/kit@2.7.7",
"@sveltejs/kit@2.7.6",
"@sveltejs/kit@2.7.5",
"@sveltejs/enhanced-img@0.4.1",
"svelte-migrate@1.6.8",
"svelte-migrate@1.6.7",
"@sveltejs/kit@2.7.4",
"@sveltejs/enhanced-img@0.4.0",
"svelte-migrate@1.6.6",
"@sveltejs/package@2.3.7",
"@sveltejs/kit@2.7.3",
"@sveltejs/enhanced-img@0.3.10",
"@sveltejs/amp@1.1.4",
"@sveltejs/adapter-vercel@5.4.6",
"@sveltejs/adapter-static@3.0.6",
"@sveltejs/adapter-node@5.2.9",
"@sveltejs/adapter-netlify@4.3.6",
"@sveltejs/adapter-cloudflare@4.7.4",
"@sveltejs/adapter-cloudflare-workers@2.5.6",
"@sveltejs/adapter-auto@3.3.1",
"create-svelte@7.0.0",
"svelte-migrate@1.6.4",
"@sveltejs/kit@2.7.2",
"svelte-migrate@1.6.3",
"@sveltejs/adapter-node@5.2.8",
"@sveltejs/kit@2.7.1",
"@sveltejs/adapter-node@5.2.7",
"create-svelte@6.4.0",
"@sveltejs/kit@2.7.0",
"@sveltejs/enhanced-img@0.3.9",
"@sveltejs/adapter-netlify@4.3.5",
"@sveltejs/adapter-cloudflare@4.7.3",
"@sveltejs/adapter-cloudflare-workers@2.5.5",
"@sveltejs/adapter-node@5.2.6",
"svelte-migrate@1.6.2",
"svelte-migrate@1.6.1",
"@sveltejs/kit@2.6.4",
"@sveltejs/kit@2.6.3",
"@sveltejs/adapter-vercel@5.4.5",
"svelte-migrate@1.6.0",
"@sveltejs/kit@2.6.2",
"svelte-migrate@1.5.1",
"svelte-migrate@1.5.0",
"@sveltejs/kit@2.6.1",
"create-svelte@6.3.12",
"@sveltejs/kit@2.6.0",
"@sveltejs/adapter-node@5.2.5",
"@sveltejs/adapter-node@5.2.4",
"create-svelte@6.3.11",
"@sveltejs/kit@2.5.28",
"@sveltejs/enhanced-img@0.3.8",
"@sveltejs/adapter-vercel@5.4.4",
"@sveltejs/adapter-static@3.0.5",
"@sveltejs/adapter-node@5.2.3",
"@sveltejs/adapter-netlify@4.3.4",
"@sveltejs/adapter-auto@3.2.5",
"@sveltejs/enhanced-img@0.3.7",
"@sveltejs/enhanced-img@0.3.6",
"@sveltejs/package@2.3.5",
"@sveltejs/kit@2.5.27",
"@sveltejs/enhanced-img@0.3.5",
"create-svelte@6.3.10",
"@sveltejs/kit@2.5.26",
"create-svelte@6.3.9",
"@sveltejs/kit@2.5.25",
"@sveltejs/enhanced-img@0.3.4",
"@sveltejs/kit@2.5.24",
"create-svelte@6.3.8",
"@sveltejs/kit@2.5.23",
"svelte-migrate@1.4.5",
"create-svelte@6.3.7",
"@sveltejs/package@2.3.4",
"@sveltejs/kit@2.5.22",
"@sveltejs/enhanced-img@0.3.3",
"@sveltejs/amp@1.1.3",
"@sveltejs/adapter-vercel@5.4.3",
"@sveltejs/adapter-static@3.0.4",
"@sveltejs/adapter-node@5.2.2",
"@sveltejs/adapter-netlify@4.3.3",
"@sveltejs/adapter-cloudflare@4.7.2",
"@sveltejs/adapter-cloudflare-workers@2.5.4",
"@sveltejs/adapter-auto@3.2.4",
"svelte-migrate@1.4.4",
"create-svelte@6.3.6",
"@sveltejs/package@2.3.3",
"@sveltejs/kit@2.5.21",
"@sveltejs/enhanced-img@0.3.2",
"@sveltejs/amp@1.1.2",
"@sveltejs/adapter-vercel@5.4.2",
"@sveltejs/adapter-static@3.0.3",
"@sveltejs/adapter-node@5.2.1",
"@sveltejs/adapter-netlify@4.3.2",
"@sveltejs/adapter-cloudflare@4.7.1",
"@sveltejs/adapter-cloudflare-workers@2.5.3",
"@sveltejs/adapter-auto@3.2.3",
"@sveltejs/kit@2.5.20",
"@sveltejs/kit@2.5.19",
"create-svelte@6.3.5",
"create-svelte@6.3.4",
"@sveltejs/enhanced-img@0.3.1",
"@sveltejs/adapter-cloudflare@4.7.0",
"@sveltejs/adapter-cloudflare-workers@2.5.2",
"@sveltejs/adapter-vercel@5.4.1",
"@sveltejs/adapter-netlify@4.3.1",
"@sveltejs/adapter-cloudflare@4.6.1",
"@sveltejs/adapter-cloudflare-workers@2.5.1",
"create-svelte@6.3.3",
"@sveltejs/kit@2.5.18",
"@sveltejs/adapter-vercel@5.4.0",
"@sveltejs/adapter-netlify@4.3.0",
"@sveltejs/adapter-cloudflare@4.6.0",
"@sveltejs/adapter-cloudflare-workers@2.5.0",
"@sveltejs/kit@2.5.17",
"@sveltejs/adapter-node@5.2.0",
"@sveltejs/adapter-cloudflare@4.5.0",
"@sveltejs/kit@2.5.16",
"@sveltejs/adapter-node@5.1.1",
"@sveltejs/kit@2.5.15",
"create-svelte@6.3.2",
"@sveltejs/kit@2.5.14",
"@sveltejs/kit@2.5.13",
"@sveltejs/kit@2.5.12",
"@sveltejs/adapter-node@5.1.0",
"svelte-migrate@1.4.3",
"create-svelte@6.3.1",
"@sveltejs/package@2.3.2",
"@sveltejs/kit@2.5.11",
"@sveltejs/enhanced-img@0.3.0",
"@sveltejs/amp@1.1.1",
"@sveltejs/adapter-vercel@5.3.2",
"@sveltejs/adapter-static@3.0.2",
"@sveltejs/adapter-node@5.0.2",
"@sveltejs/adapter-netlify@4.2.1",
"@sveltejs/adapter-cloudflare@4.4.1",
"@sveltejs/adapter-cloudflare-workers@2.4.1",
"@sveltejs/adapter-auto@3.2.2",
"create-svelte@6.3.0",
"@sveltejs/enhanced-img@0.2.1",
"@sveltejs/adapter-vercel@5.3.1",
"svelte-migrate@1.4.2",
"create-svelte@6.2.0",
"@sveltejs/kit@2.5.10",
"@sveltejs/adapter-auto@3.2.1",
"@sveltejs/kit@2.5.9",
"svelte-migrate@1.4.1",
"@sveltejs/kit@2.5.8",
"@sveltejs/kit@2.5.7",
"svelte-migrate@1.4.0",
"create-svelte@6.1.1",
"@sveltejs/kit@2.5.6",
"@sveltejs/adapter-vercel@5.3.0",
"@sveltejs/adapter-netlify@4.2.0",
"@sveltejs/adapter-cloudflare@4.4.0",
"@sveltejs/adapter-cloudflare-workers@2.4.0",
"create-svelte@6.1.0",
"@sveltejs/adapter-cloudflare@4.3.0",
"@sveltejs/adapter-cloudflare-workers@2.3.0",
"@sveltejs/package@2.3.1",
"@sveltejs/adapter-cloudflare@4.2.1",
"@sveltejs/adapter-cloudflare-workers@2.2.1",
"@sveltejs/enhanced-img@0.2.0",
"@sveltejs/kit@2.5.5",
"@sveltejs/adapter-auto@3.2.0",
"create-svelte@6.0.10",
"@sveltejs/adapter-vercel@5.2.0",
"@sveltejs/enhanced-img@0.1.9",
"svelte-migrate@1.3.8",
"@sveltejs/kit@2.5.4",
"@sveltejs/adapter-cloudflare@4.2.0",
"@sveltejs/adapter-cloudflare-workers@2.2.0",
"@sveltejs/adapter-vercel@5.1.1",
"@sveltejs/adapter-node@5.0.1",
"@sveltejs/package@2.3.0",
"@sveltejs/kit@2.5.3",
"@sveltejs/adapter-node@5.0.0",
"@sveltejs/kit@2.5.2",
"create-svelte@6.0.9",
"@sveltejs/package@2.2.7",
"@sveltejs/kit@2.5.1",
"create-svelte@5.3.4",
"svelte-migrate@1.3.7",
"@sveltejs/kit@2.5.0",
"@sveltejs/kit@2.4.3",
"@sveltejs/adapter-node@4.0.1",
"@sveltejs/kit@2.4.2",
"@sveltejs/adapter-auto@3.1.1",
"@sveltejs/kit@2.4.1",
"@sveltejs/adapter-vercel@5.1.0",
"@sveltejs/adapter-netlify@4.1.0",
"@sveltejs/kit@2.4.0",
"@sveltejs/adapter-vercel@5.0.0",
"@sveltejs/adapter-node@4.0.0",
"@sveltejs/adapter-netlify@4.0.0",
"@sveltejs/adapter-cloudflare@4.1.0",
"@sveltejs/adapter-cloudflare-workers@2.1.0",
"@sveltejs/adapter-cloudflare@4.0.2",
"@sveltejs/kit@2.3.5",
"@sveltejs/kit@2.3.4",
"create-svelte@6.0.8",
"@sveltejs/adapter-vercel@4.0.5",
"@sveltejs/adapter-node@3.0.1",
"@sveltejs/adapter-netlify@3.0.2",
"@sveltejs/adapter-cloudflare@4.0.1",
"@sveltejs/adapter-cloudflare-workers@2.0.3",
"create-svelte@6.0.7",
"@sveltejs/package@2.2.6",
"@sveltejs/kit@2.3.3",
"@sveltejs/adapter-cloudflare@4.0.0",
"@sveltejs/kit@2.3.2",
"@sveltejs/adapter-cloudflare@3.0.2",
"@sveltejs/adapter-cloudflare-workers@2.0.2",
"@sveltejs/kit@2.3.1",
"@sveltejs/enhanced-img@0.1.8",
"@sveltejs/adapter-node@3.0.0",
"@sveltejs/kit@2.3.0",
"@sveltejs/kit@2.2.2",
"@sveltejs/adapter-node@2.1.1",
"@sveltejs/kit@2.2.1",
"@sveltejs/kit@2.2.0",
"@sveltejs/kit@2.1.2",
"@sveltejs/kit@2.1.1",
"@sveltejs/adapter-node@2.1.0",
"@sveltejs/kit@2.1.0",
"@sveltejs/kit@2.0.8",
"create-svelte@6.0.6",
"@sveltejs/kit@2.0.7",
"@sveltejs/adapter-vercel@4.0.4",
"@sveltejs/adapter-auto@3.1.0",
"@sveltejs/package@2.2.5",
"create-svelte@6.0.5",
"@sveltejs/kit@2.0.6",
"@sveltejs/kit@2.0.5",
"@sveltejs/adapter-node@2.0.2",
"svelte-migrate@1.3.6",
"svelte-migrate@1.3.5",
"create-svelte@6.0.4",
"@sveltejs/package@2.2.4",
"@sveltejs/kit@2.0.4",
"@sveltejs/enhanced-img@0.1.7",
"@sveltejs/adapter-vercel@4.0.3",
"@sveltejs/adapter-static@3.0.1",
"@sveltejs/adapter-node@2.0.1",
"@sveltejs/adapter-netlify@3.0.1",
"@sveltejs/adapter-cloudflare@3.0.1",
"@sveltejs/adapter-cloudflare-workers@2.0.1",
"@sveltejs/adapter-auto@3.0.1",
"svelte-migrate@1.3.4",
"create-svelte@6.0.3",
"@sveltejs/kit@2.0.3",
"create-svelte@6.0.2",
"@sveltejs/kit@2.0.2",
"create-svelte@6.0.1",
"@sveltejs/kit@2.0.1",
"@sveltejs/adapter-vercel@4.0.2",
"svelte-migrate@1.3.3",
"svelte-migrate@1.3.2",
"@sveltejs/adapter-vercel@4.0.1",
"svelte-migrate@1.3.1",
"svelte-migrate@1.3.0",
"create-svelte@6.0.0",
"@sveltejs/kit@2.0.0",
"@sveltejs/enhanced-img@0.1.6",
"@sveltejs/amp@1.1.0",
"@sveltejs/adapter-vercel@4.0.0",
"@sveltejs/adapter-static@3.0.0",
"@sveltejs/adapter-node@2.0.0",
"@sveltejs/adapter-netlify@3.0.0",
"@sveltejs/adapter-cloudflare@3.0.0",
"@sveltejs/adapter-cloudflare-workers@2.0.0",
"@sveltejs/adapter-auto@3.0.0",
"@sveltejs/kit@1.30.3",
"@sveltejs/kit@1.30.2",
"@sveltejs/kit@1.30.1",
"@sveltejs/kit@1.30.0",
"@sveltejs/kit@1.29.1",
"@sveltejs/kit@1.29.0",
"@sveltejs/kit@1.28.0",
"@sveltejs/adapter-cloudflare-workers@1.2.3",
"svelte-migrate@1.2.8",
"create-svelte@5.3.3",
"@sveltejs/kit@1.27.7",
"@sveltejs/adapter-cloudflare@2.3.4",
"@sveltejs/adapter-cloudflare-workers@1.2.2",
"create-svelte@5.3.2",
"@sveltejs/package@2.2.3",
"@sveltejs/enhanced-img@0.1.5",
"@sveltejs/adapter-vercel@3.1.0",
"@sveltejs/enhanced-img@0.1.4",
"create-svelte@5.3.1",
"@sveltejs/enhanced-img@0.1.3",
"create-svelte@5.3.0",
"@sveltejs/kit@1.27.6",
"@sveltejs/enhanced-img@0.1.2",
"create-svelte@5.2.0",
"@sveltejs/adapter-cloudflare-workers@1.2.1",
"@sveltejs/kit@1.27.5",
"@sveltejs/enhanced-img@0.1.1",
"@sveltejs/kit@1.27.4",
"@sveltejs/kit@1.27.3",
"@sveltejs/adapter-auto@2.1.1",
"@sveltejs/kit@1.27.2",
"@sveltejs/adapter-cloudflare-workers@1.2.0",
"@sveltejs/kit@1.27.1",
"@sveltejs/kit@1.27.0",
"@sveltejs/kit@1.26.0",
"create-svelte@5.1.1",
"@sveltejs/kit@1.25.2",
"svelte-migrate@1.2.7",
"create-svelte@5.1.0",
"@sveltejs/kit@1.25.1",
"create-svelte@5.0.6",
"@sveltejs/kit@1.25.0",
"@sveltejs/kit@1.24.1",
"@sveltejs/kit@1.24.0",
"@sveltejs/kit@1.23.1",
"@sveltejs/package@2.2.2",
"@sveltejs/kit@1.23.0",
"@sveltejs/adapter-cloudflare@2.3.3",
"@sveltejs/kit@1.22.6",
"create-svelte@5.0.5",
"@sveltejs/package@2.2.1",
"@sveltejs/kit@1.22.5",
"create-svelte@5.0.4",
"@sveltejs/kit@1.22.4",
"@sveltejs/adapter-vercel@3.0.3",
"@sveltejs/adapter-cloudflare@2.3.2",
"@sveltejs/adapter-cloudflare-workers@1.1.4",
"@sveltejs/adapter-static@2.0.3",
"@sveltejs/kit@1.22.3",
"svelte-migrate@1.2.6",
"create-svelte@5.0.3",
"@sveltejs/package@2.2.0",
"@sveltejs/kit@1.22.2",
"@sveltejs/adapter-vercel@3.0.2",
"@sveltejs/adapter-netlify@2.0.8",
"@sveltejs/adapter-cloudflare@2.3.1",
"@sveltejs/adapter-cloudflare-workers@1.1.3",
"svelte-migrate@1.2.5",
"@sveltejs/kit@1.22.1",
"@sveltejs/kit@1.22.0",
"@sveltejs/adapter-node@1.3.1",
"@sveltejs/adapter-node@1.3.0",
"create-svelte@5.0.2",
"@sveltejs/kit@1.21.0",
"svelte-migrate@1.2.4",
"create-svelte@5.0.1",
"@sveltejs/package@2.1.0",
"@sveltejs/kit@1.20.5",
"svelte-migrate@1.2.3",
"create-svelte@5.0.0",
"svelte-migrate@1.2.2",
"@sveltejs/kit@1.20.3",
"@sveltejs/kit@1.20.2",
"@sveltejs/kit@1.20.1",
"@sveltejs/adapter-vercel@3.0.1",
"svelte-migrate@1.2.1",
"svelte-migrate@1.2.0",
"@sveltejs/kit@1.20.0",
"@sveltejs/kit@1.19.0",
"@sveltejs/adapter-cloudflare@2.3.0",
"@sveltejs/kit@1.18.0",
"@sveltejs/kit@1.17.1",
"@sveltejs/adapter-cloudflare@2.2.4",
"@sveltejs/adapter-auto@2.1.0",
"@sveltejs/kit@1.17.0",
"@sveltejs/adapter-vercel@3.0.0",
"@sveltejs/adapter-cloudflare@2.2.3",
"@sveltejs/adapter-cloudflare-workers@1.1.2",
"@sveltejs/kit@1.16.2",
"@sveltejs/kit@1.16.3",
"create-svelte@4.2.0",
"@sveltejs/kit@1.16.1",
"@sveltejs/kit@1.16.0",
"@sveltejs/kit@1.15.11",
"@sveltejs/adapter-cloudflare@2.2.2",
"create-svelte@4.1.1",
"@sveltejs/kit@1.15.10",
"create-svelte@4.1.0",
"@sveltejs/adapter-vercel@2.4.3",
"@sveltejs/adapter-node@1.2.4",
"@sveltejs/adapter-netlify@2.0.7",
"@sveltejs/adapter-cloudflare@2.2.1",
"@sveltejs/adapter-cloudflare-workers@1.1.1",
"create-svelte@4.0.0",
"@sveltejs/kit@1.15.9",
"create-svelte@3.3.1",
"@sveltejs/kit@1.15.8",
"@sveltejs/adapter-auto@2.0.1",
"@sveltejs/kit@1.15.7",
"@sveltejs/adapter-vercel@2.4.2",
"@sveltejs/kit@1.15.6",
"@sveltejs/kit@1.15.5",
"@sveltejs/kit@1.15.4",
"@sveltejs/kit@1.15.3",
"@sveltejs/adapter-static@2.0.2",
"create-svelte@3.3.0",
"@sveltejs/kit@1.15.2",
"@sveltejs/kit@1.15.1",
"@sveltejs/kit@1.15.0",
"@sveltejs/adapter-vercel@2.4.1",
"@sveltejs/kit@1.14.0",
"create-svelte@3.2.0",
"@sveltejs/kit@1.13.0",
"@sveltejs/adapter-vercel@2.4.0",
"@sveltejs/kit@1.12.0",
"@sveltejs/adapter-vercel@2.3.2",
"@sveltejs/adapter-node@1.2.3",
"create-svelte@3.1.2",
"@sveltejs/kit@1.11.0",
"@sveltejs/adapter-vercel@2.3.1",
"@sveltejs/adapter-node@1.2.2",
"@sveltejs/adapter-netlify@2.0.6",
"create-svelte@3.1.1",
"@sveltejs/kit@1.10.0",
"@sveltejs/adapter-vercel@2.3.0",
"@sveltejs/adapter-cloudflare@2.2.0",
"@sveltejs/adapter-cloudflare-workers@1.1.0",
"@sveltejs/kit@1.9.3",
"@sveltejs/adapter-node@1.2.1",
"@sveltejs/adapter-vercel@2.2.1",
"@sveltejs/kit@1.9.2",
"@sveltejs/kit@1.9.1",
"@sveltejs/kit@1.9.0",
"@sveltejs/adapter-cloudflare@2.1.0",
"@sveltejs/kit@1.8.8",
"@sveltejs/adapter-vercel@2.2.0",
"@sveltejs/kit@1.8.7",
"@sveltejs/kit@1.8.6",
"create-svelte@3.1.0",
"@sveltejs/kit@1.8.5",
"@sveltejs/kit@1.8.4",
"create-svelte@3.0.4",
"@sveltejs/adapter-vercel@2.1.1",
"create-svelte@3.0.3",
"@sveltejs/adapter-vercel@2.1.0",
"svelte-migrate@1.1.3",
"@sveltejs/kit@1.8.3",
"@sveltejs/kit@1.8.2",
"@sveltejs/kit@1.8.1",
"svelte-migrate@1.1.2",
"@sveltejs/package@2.0.2",
"create-svelte@3.0.2",
"@sveltejs/kit@1.8.0",
"@sveltejs/kit@1.7.2",
"@sveltejs/adapter-vercel@2.0.4",
"@sveltejs/adapter-vercel@2.0.3",
"create-svelte@3.0.1",
"svelte-migrate@1.1.1",
"@sveltejs/package@2.0.1",
"svelte-migrate@1.1.0",
"create-svelte@3.0.0",
"@sveltejs/package@2.0.0",
"@sveltejs/kit@1.7.1",
"@sveltejs/adapter-netlify@2.0.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32388.json"
}
}
],
"modified": "2026-10-28T02:30:36.066798291Z",
"provider": "osv",
"references": [
"https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.20.6",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32388.json",
"https://github.com/sveltejs/kit/security/advisories/GHSA-6q87-84jw-cjhp",
"https://nvd.nist.gov/vuln/detail/CVE-2025-32388",
"https://github.com/sveltejs/kit/commit/d3300c6a67908590266c363dba7b0835d9a194cf"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32388.json"
}
},
"related_cves": [
{
"value": "CVE-2025-32388",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 503304,
"published_at": "2025-04-15T22:32:06.059+00:00"
}